feat: rename to BitGate and close the drop-in gap

Renames the project and makes it as easy to adopt as BitLogin, which was the
stated bar and which it did not previously meet.

Rename (ADR 0005): @nostr-governance/* -> @bitgate/*, governance-* elements ->
bitgate-*, createGovernanceRuntime -> createBitGate. "Governance" reads as DAO
voting to this audience and named a category rather than a product; BitGate
names the benefit and joins the bit- family that BitVid and BitRoad compose
with. Domain types keep their names — the product is BitGate, the subject
matter is still governance. The migration plan is left as written; this ADR
records the change rather than rewriting history.

Drop-in distribution (ADR 0006): adopting BitGate meant supplying a transport,
authoring a policy, and wiring every element in JavaScript. Now:

- createRelayTransport(urls) — WebSocket transport with reconnection, backoff,
  subscription replay, and cross-relay dedupe
- policy presets (social, commerce, admin-only) addressable by name; the engine
  still carries no thresholds of its own
- <bitgate-provider> — configuration in markup, with descendants finding the
  runtime through a bubbling context event rather than DOM walking, which
  breaks across shadow boundaries
- npm run build:widget — a self-contained dist/bitgate.js

That last one came from running it in a browser rather than from a test. Bare
specifiers resolve in Node and vitest but not in a browser, so the widget
source worked everywhere except a plain static page — the one place it exists
to serve. The bundle is not committed: consumers build from reviewed source.

Also found by running it: the provider's ready event fires during element
upgrade, before a page that defines elements after parsing can attach a
listener, so it now exposes `ready` as a promise too.

Four bugs fixed along the way, three found by new tests and one by the browser:
admin state stayed silent when a roster change altered capabilities but no
denials; the relay transport sent every subscription twice on connect; the
commerce preset computed a meaningless visibility verdict at checkout and could
hide a listing from its own seller; <bitgate-status> threw on an unusable
decision.

759 tests; lint, typecheck, and both builds clean.

examples/commerce/README.md

@@ -4,7 +4,7 @@ A marketplace built on `nostr-governance`, using only the published API.
 
 The point is not to ship marketplace moderation. It is to prove the engine did
 not accidentally stay video-specific during extraction: if a commerce consumer
-needs a change to `@nostr-governance/core`, the abstraction is wrong.
+needs a change to `@bitgate/core`, the abstraction is wrong.
 
 ## What it demonstrates
 

examples/commerce/demo.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>nostr-governance widget demo</title>
+    <title>BitGate widget demo</title>
     <style>
       :root { color-scheme: light dark; }
       body {
@@ -29,20 +29,20 @@
     </style>
   </head>
   <body>
-    <h1>nostr-governance widget</h1>
+    <h1>BitGate widget demo</h1>
     <p class="lede">
       Every element below reads from one shared runtime. Toggle governance state
       and watch each surface reach its own conclusion from the same evidence.
     </p>
 
     <section>
-      <h2>Viewer surface — <code>&lt;governance-veil&gt;</code></h2>
-      <governance-veil id="veil" profile="public-marketplace">
+      <h2>Viewer surface — <code>&lt;bitgate-veil&gt;</code></h2>
+      <bitgate-veil id="veil" profile="public-marketplace">
         <div class="card">
           <img alt="" />
           <p><strong>Widget</strong> — 1000 sats</p>
         </div>
-      </governance-veil>
+      </bitgate-veil>
 
       <div class="controls">
         <button id="report">Add a trusted scam report</button>
@@ -61,8 +61,8 @@
     </section>
 
     <section>
-      <h2>Status readout — <code>&lt;governance-status&gt;</code></h2>
-      <governance-status id="status" profile="seller-dashboard"></governance-status>
+      <h2>Status readout — <code>&lt;bitgate-status&gt;</code></h2>
+      <bitgate-status id="status" profile="seller-dashboard"></bitgate-status>
     </section>
 
     <section>
@@ -72,20 +72,20 @@
         listings but not sellers. Note that the refused control stays visible
         and says what it needs.
       </p>
-      <governance-capabilities id="caps"></governance-capabilities>
-      <governance-admin-panel id="panel"></governance-admin-panel>
+      <bitgate-capabilities id="caps"></bitgate-capabilities>
+      <bitgate-admin-panel id="panel"></bitgate-admin-panel>
     </section>
 
     <script type="module">
       import {
         createCommands,
-        createGovernanceRuntime,
+        createBitGate,
         createMemoryTransport,
       } from "../../packages/runtime/src/index.js";
-      import { defineGovernanceElements } from "../../packages/widget/src/index.js";
+      import { defineBitGateElements } from "../../packages/widget/src/index.js";
       import { COMMERCE_POLICY, COMMERCE_ROLE_CAPABILITIES } from "./src/policy.js";
 
-      defineGovernanceElements();
+      defineBitGateElements();
 
       const key = (seed) => seed.repeat(64).slice(0, 64);
       const ROOT = key("a1");
@@ -95,7 +95,7 @@
       const NOW = Math.floor(Date.now() / 1000);
       const trusted = (i) => key(i.toString(16).padStart(2, "0"));
 
-      const runtime = createGovernanceRuntime({
+      const runtime = createBitGate({
         applicationId: "commerce-demo",
         namespace: "commerce",
         root: ROOT,

examples/commerce/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "@nostr-governance/example-commerce",
+  "name": "@bitgate/example-commerce",
   "version": "0.1.0",
   "type": "module",
   "private": true,
@@ -9,7 +9,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@nostr-governance/core": "*",
-    "@nostr-governance/runtime": "*"
+    "@bitgate/core": "*",
+    "@bitgate/runtime": "*"
   }
 }

examples/commerce/src/adapters.js

@@ -5,7 +5,7 @@
 // no thresholds, no precedence rules, no policy logic. Those live in the
 // policy definition and the engine respectively.
 
-import { createApplicationAdapter } from "@nostr-governance/core";
+import { createApplicationAdapter } from "@bitgate/core";
 
 /** Parameterized-replaceable kind used for commerce documents in this example. */
 export const PRODUCT_KIND = 30078;
@@ -43,7 +43,7 @@ export const PRODUCT_KIND = 30078;
  * would not. Both are kept, because an exact-event denial must also stay
  * possible for the case where only one revision was bad.
  *
- * @type {import('@nostr-governance/core').GovernanceApplicationAdapter<Product>}
+ * @type {import('@bitgate/core').GovernanceApplicationAdapter<Product>}
  */
 export const productAdapter = createApplicationAdapter({
   applicationId: "commerce-example",
@@ -84,7 +84,7 @@ export const productAdapter = createApplicationAdapter({
 
 /**
  * Storefronts answer to the seller, the storefront address, and the exact event.
- * @type {import('@nostr-governance/core').GovernanceApplicationAdapter<Storefront>}
+ * @type {import('@bitgate/core').GovernanceApplicationAdapter<Storefront>}
  */
 export const storefrontAdapter = createApplicationAdapter({
   applicationId: "commerce-example",
@@ -114,7 +114,7 @@ export const storefrontAdapter = createApplicationAdapter({
  * honest reviews of it, which is exactly the outcome an over-broad target list
  * would produce.
  *
- * @type {import('@nostr-governance/core').GovernanceApplicationAdapter<Review>}
+ * @type {import('@bitgate/core').GovernanceApplicationAdapter<Review>}
  */
 export const reviewAdapter = createApplicationAdapter({
   applicationId: "commerce-example",
@@ -141,7 +141,7 @@ export const reviewAdapter = createApplicationAdapter({
 
 /**
  * Sellers answer only to their own user target.
- * @type {import('@nostr-governance/core').GovernanceApplicationAdapter<{ pubkey: string }>}
+ * @type {import('@bitgate/core').GovernanceApplicationAdapter<{ pubkey: string }>}
  */
 export const sellerAdapter = createApplicationAdapter({
   applicationId: "commerce-example",

examples/commerce/src/marketplace.js

@@ -4,7 +4,7 @@
 // the answer. It computes no thresholds and reimplements no precedence — which
 // is the property the extraction is meant to guarantee.
 
-import { collectTargets, evaluateObject } from "@nostr-governance/core";
+import { collectTargets, evaluateObject } from "@bitgate/core";
 
 import { productAdapter } from "./adapters.js";
 
@@ -20,7 +20,7 @@ import { productAdapter } from "./adapters.js";
  * listing.
  *
  * @param {Product[]} products
- * @param {import('@nostr-governance/runtime').GovernanceRuntime} runtime
+ * @param {import('@bitgate/runtime').GovernanceRuntime} runtime
  * @param {string} profile
  * @returns {Array<Product & { moderation: any }>}
  */
@@ -43,7 +43,7 @@ export function governProductFeed(products, runtime, profile) {
  * like censorship to sellers.
  *
  * @param {Product[]} products
- * @param {import('@nostr-governance/runtime').GovernanceRuntime} runtime
+ * @param {import('@bitgate/runtime').GovernanceRuntime} runtime
  * @returns {Array<Product & { moderation: any }>}
  */
 export function buildMarketplaceGrid(products, runtime) {
@@ -67,7 +67,7 @@ export function buildMarketplaceGrid(products, runtime) {
  * checkout is the point where being wrong actually costs someone money.
  *
  * @param {Product} product
- * @param {import('@nostr-governance/runtime').GovernanceRuntime} runtime
+ * @param {import('@bitgate/runtime').GovernanceRuntime} runtime
  * @returns {CheckoutVerdict}
  */
 export function checkoutVerdict(product, runtime) {
@@ -90,7 +90,7 @@ export function checkoutVerdict(product, runtime) {
  * that can answer "how many people reported me, and for what".
  *
  * @param {Product} product
- * @param {import('@nostr-governance/runtime').GovernanceRuntime} runtime
+ * @param {import('@bitgate/runtime').GovernanceRuntime} runtime
  * @returns {{ visible: boolean, sellable: boolean, reasons: string[], evidence: any }}
  */
 export function explainToSeller(product, runtime) {

examples/commerce/src/policy.js

@@ -1,7 +1,7 @@
 // Commerce policy profiles.
 //
 // This example exists to prove the engine is not video-specific. Nothing here
-// touches @nostr-governance/core internals: it is built entirely from the
+// touches @bitgate/core internals: it is built entirely from the
 // public API, and the core carries none of these numbers.
 //
 // The interesting property is that one product can simultaneously be visible to
@@ -9,7 +9,7 @@
 // blocked from checkout — four different answers from one decision, which a
 // single `hidden` boolean could not express.
 
-import { createPolicyDefinition, createRoleDefinition } from "@nostr-governance/core";
+import { createPolicyDefinition, createRoleDefinition } from "@bitgate/core";
 
 /**
  * Category thresholds for a marketplace.
@@ -18,7 +18,7 @@ import { createPolicyDefinition, createRoleDefinition } from "@nostr-governance/
  * blocks checkout, because the cost of a false negative is a compromised buyer,
  * while an over-eager `misleading` threshold would just suppress lawful listings.
  *
- * @type {Record<string, import('@nostr-governance/core').CategoryThresholds>}
+ * @type {Record<string, import('@bitgate/core').CategoryThresholds>}
  */
 export const MARKETPLACE_REPORT_THRESHOLDS = {
   scam: {
@@ -137,7 +137,7 @@ export const COMMERCE_ROLES = {
 
 /**
  * Role capability map in the shape createAuthorityState expects.
- * @type {Record<string, import('@nostr-governance/core').GovernanceCapability[]>}
+ * @type {Record<string, import('@bitgate/core').GovernanceCapability[]>}
  */
 export const COMMERCE_ROLE_CAPABILITIES = Object.fromEntries(
   Object.values(COMMERCE_ROLES).map((role) => [role.name, role.capabilities]),

examples/commerce/test/proof-of-fit.test.js

@@ -6,7 +6,7 @@
 
 import { describe, expect, it } from "vitest";
 
-import { createCommands, createGovernanceRuntime, createMemoryTransport } from "@nostr-governance/runtime";
+import { createCommands, createBitGate, createMemoryTransport } from "@bitgate/runtime";
 
 import { COMMERCE_POLICY, COMMERCE_ROLE_CAPABILITIES } from "../src/policy.js";
 import { productAdapter, reviewAdapter, sellerAdapter } from "../src/adapters.js";
@@ -57,7 +57,7 @@ const RIVAL_PRODUCT = {
 };
 
 function setup({ allowlisted = [SELLER, OTHER_SELLER] } = {}) {
-  const runtime = createGovernanceRuntime({
+  const runtime = createBitGate({
     applicationId: "commerce-example",
     namespace: "commerce",
     transport: createMemoryTransport(),
@@ -298,7 +298,7 @@ describe("7. moderator capability checks", () => {
   });
 
   function commandsAs(pubkey) {
-    const runtime = createGovernanceRuntime({
+    const runtime = createBitGate({
       applicationId: "commerce-example",
       namespace: "commerce",
       transport: createMemoryTransport(),
@@ -462,7 +462,7 @@ describe("10. no core changes required", () => {
     // Every import in this example resolves through a package entry point; if
     // one reached into a package's internals, the reference guard and this
     // assertion are what would catch it.
-    const core = await import("@nostr-governance/core");
+    const core = await import("@bitgate/core");
     for (const name of [
       "createApplicationAdapter",
       "evaluateObject",

examples/dropin.html

@@ -0,0 +1,60 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>BitGate drop-in</title>
+  </head>
+  <body>
+    <h1>Drop-in test</h1>
+
+    <!-- Everything below is configured in markup. No setup JavaScript. -->
+    <bitgate-provider relays="wss://relay.example" root="a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1" policy="social">
+      <bitgate-veil profile="feed" target-user="d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4">
+        <p id="content">This content is governed.</p>
+      </bitgate-veil>
+      <bitgate-status profile="playback" target-user="d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4"></bitgate-status>
+    </bitgate-provider>
+
+    <pre id="result">running…</pre>
+
+    <script type="module">
+      import { defineBitGateElements } from "../packages/widget/dist/bitgate.js";
+      defineBitGateElements();
+
+      const out = [];
+      const provider = document.querySelector("bitgate-provider");
+      const veil = document.querySelector("bitgate-veil");
+
+      // Awaiting the promise avoids racing the ready event, which fires during
+      // element upgrade — before this script could attach a listener.
+      provider.ready.then(() => {
+        out.push("provider ready: " + Boolean(provider.runtime));
+        out.push("veil adopted runtime: " + (veil.runtime === provider.runtime));
+        out.push("policy: " + provider.runtime.policies.policy.id);
+        out.push("target from attribute: " + JSON.stringify(veil.target));
+
+        // Deny the creator and confirm the veil reacts with no further wiring.
+        provider.runtime.admin.setRoles({
+          root: "a1".repeat(32),
+          actors: { ["a1".repeat(32)]: ["super_admin"] },
+        });
+        provider.runtime.admin.upsertContribution({
+          actor: "a1".repeat(32),
+          kind: "user-deny",
+          targets: [{ type: "user", pubkey: "d4".repeat(32) }],
+          createdAt: 1,
+        });
+
+        // The social preset's feed profile caps a hide at "restrict", so the
+        // veil blurs rather than hides. Playback enforces the full decision.
+        const feed = provider.runtime.evaluate(veil.target, { profile: "feed" });
+        const playback = provider.runtime.evaluate(veil.target, { profile: "playback" });
+        out.push("feed visibility: " + feed.visibility.effect + " (blurred, not hidden)");
+        out.push("playback visibility: " + playback.visibility.effect);
+        out.push("reasons: " + feed.reasons.map((r) => r.id).join(", "));
+        out.push("veil is blurred: " + Boolean(veil.shadowRoot.querySelector(".blurred")));
+        document.getElementById("result").textContent = out.join("\n");
+      });
+    </script>
+  </body>
+</html>